Systems and methods for restricting fido key derivation identity binding

A system for implementing a pre-registration of FIDO security keys, the system comprising

• an authenticator device comprising a processor;
• and
• a memory, the memory containing a user-specific identifier, an extended private FIDO key generated using a hierarchically deterministic key generation algorithm, wherein the processor is configured to:
• generate a child FIDO key pair including a child private key and a child public key;
• transmit the child public key along with the user-specific identifier to a FIDO-reliant server during a FIDO registration process associated with the authenticator device;
• a server, comprising a processor and a memory, the memory containing the user-specific identifier and an extended public FIDO key generated from the extended private FIDO key, wherein the processor being configured to:
• receive the child public key along with the user-specific identifier from the FIDO reliant server during the FIDO registration process of the authenticator device,
• verify that the child public key is associated with the user-specific identifier using the extended public FIDO key;
• and
• transmit a verification message to the FIDO-reliant server, the verification being operative to complete a registration of the authenticator device associated with the child public key and the user-specific identifier.

A non-transitory computer-accessible medium comprising instructions for execution by a computer hardware arrangement, wherein, upon execution of the instructions the computer hardware arrangement performs procedures comprising:

• generating an extended public key from an extended private key, the extended public key being stored with an account issuing entity;
• deriving, from the extended private key, one of more child key pairs including a child private key and a corresponding child public key, wherein the extended private key is stored on an authenticator device associated with a user, the authenticator device being provided by the account issuing entity;
• initiating a FIDO registration of the authenticator device with a FIDO-reliant party using a user-specific identifier and a site-specific child public key derived for the FIDO-reliant party;
• sending, by the FIDO-reliant party, the user-specific identifier and the site-specific child public key to the issuing entity;
• verifying, by the account issuing party, that the site-specific child public key is associated with the user-specific identifier using the extended public key to derive a matching key;
• and
• completing the FIDO registration upon receiving a verification message from the account issuing entity.